Just-in-time provisioning
Just-in-time provisioning creates a local user account when a person first signs in through a configured identity source, rather than requiring the account to be created beforehand.
The sign-in can create a lasting account
JIT provisioning saves an administrator from creating each account in advance. It does not mean the resulting account is temporary. The organization still needs a way to review and remove access when it is no longer appropriate.
Okta’s inbound SAML settings illustrate the choices involved. When no matching account is found, administrators can configure JIT account creation. Separate settings control profile updates and group assignments. Enabling account creation therefore deserves a review of the attributes and memberships that can accompany it.
JIT provisioning is not JIT access
Just-in-time access concerns granting access when needed, often for a limited period. JIT provisioning concerns when an account is created. Neither name proves what permissions the account receives or how long those permissions remain.
It also differs from account linking, which associates a source identity with an existing local account. When investigating an unexpected account, check the source provider, the attributes it supplied, and the local groups assigned at creation. That explains how the account arrived and what access came with it.